New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
cPanel patched CVE-2026-67401, an SQL injection in EmailTrack letting an account with mail privileges run code as root on the server.
cPanel released an advisory on September 8 for CVE-2026-67401, an SQL injection in EmailTrack that allows an authenticated account holder with mail-related privileges to create files and execute code as root. All supported cPanel and WHM release lines (11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9) are affected, with fixed builds published for each. No public exploit or exploitation has been reported and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog. The advisory carries no CVSS score, and the CVE record had not been published as of September 9.
- Authenticated account with mail privileges can write files and run code as root via EmailTrack
- Fixed builds shipped for lines 11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9
- No public exploit or exploitation report; absent from CISA KEV as of September 8
- Third cPanel flaw since July allowing ordinary hosting accounts to reach root
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-67401 | Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE CVE-2026-67401 is a critical SQL injection (CWE-89) in the EmailTrack component of cPanel, the widely used hosting control panel. An attacker holding any mail-enabled account on the server can reach the vulnerable component over the network with low privileges and no user interaction (CVSS: AV:N/AC:L/PR:L/UI:N), and the injection crosses a privilege boundary (Scope: Changed) to achieve remote code execution as root. Successful exploitation yields full compromise of the host — arbitrary commands as root with complete access to all hosted data — so every site, mailbox and account on an affected server is exposed. All cPanel deployments with mail enabled are potentially affected; the available data does not specify exact vulnerable version ranges, which are provided in WebPros security advisory AV26-908. Exploitation has not been confirmed in the wild (not in CISA KEV), but two public proof-of-concept exploits are already on GitHub, making near-term exploitation likely. Do: Upgrade cPanel to the patched release identified in WebPros advisory AV26-908 (exact fixed version numbers are not given in the available data), prioritizing internet-facing servers that host mail-enabled accounts. Until patched, restrict access to the EmailTrack component and audit mail-enabled accounts and logs for suspicious database queries or unexpected root-level processes, since public PoC exploits are already available. | 9.9 | <1% | PoC ×3 |
| masstens of millions of hosted accounts across hundreds of thousands of cPanel servers |
Full article744 words · extracted from thehackernews.com · click to collapse
Swati KhandelwalSep 09, 2026Vulnerability / Web Security
cPanel has patched a flaw that it says lets a single hosting account take control of an entire server. An authenticated account holder with mail-related privileges can create files of their choosing on the server through EmailTrack and, from there, run code as the root user.
cPanel published the advisory on September 8 and says every supported version of cPanel and WHM is affected.
The flaw is tracked as CVE-2026-67401. cPanel's advisory calls it an SQL injection issue in EmailTrack, but does not say which cPanel feature or privilege an account needs. cPanel's developer documentation lists an EmailTrack module that tracks email statistics, and the advisory does not say whether that is the affected code.
cPanel is web hosting control panel software. A customer manages one hosting account via cPanel, while the provider manages the entire machine via WHM as the root user.
Attackers exploited a different cPanel flaw in April. Taking over the panel is not the same as breaking into one customer's website, the security company Hadrian said at the time, because WHM gives an attacker root administrative access to the server.
An attacker with that access can read every hosting account on the machine, change files and databases, create hidden accounts, install malware, steal credentials, and move into customer networks.
cPanel named these fixed builds:
| Release line | Fixed build |
|---|---|
| 11.110 | 11.110.0.143 |
| 11.134 | 11.134.0.55 |
| 11.136 | 11.136.0.39 |
| 11.138 | 11.138.0.4 |
| WP Squared | 11.138.1.9 |
A server can be updated from WHM under Home / cPanel / Upgrade to Latest Version. On the command line, cPanel's instructions are to log in as root and run /usr/local/cpanel/scripts/upcp --force.
The advisory does not explain how an SQL injection problem leads to file creation and then to root access.
The advisory also offers nothing to do in the meantime for servers that cannot update straight away. cPanel gave a step like that in its July 30 advisory for a database flaw, where administrators who could not upgrade were told they could temporarily remove the MySQL feature from cPanel users.
The patched list covers the 110, 134, 136 and 138 release lines. cPanel patched the 11.118 and 11.126 lines in its July advisories, has not listed them since, and has not said whether they are still supported.
For the August flaw, the CVE record lists every version from 11.112.0.0 up to, but not including, 11.134.0.53 in the affected range and lists no fixed build in lines 118 or 126.
cPanel also does not say whether installing the patched build helps a server that was attacked before the update, or how an administrator would check.
The advisory carries no severity score. cPanel's recent CVEs are assigned through HackerOne, and the scores have been arriving in the CVE record rather than in the advisory.
The record for the August flaw was published on September 1, five days after that advisory. It scores that flaw 8.7 out of 10 on the CVSS scale, indicating high severity. No record had been published for CVE-2026-67401 when The Hacker News checked the CVE Program's record store on September 9.
No public exploit code or report of exploitation appeared in searches on September 9, and CVE-2026-67401 is absent from CISA's Known Exploited Vulnerabilities catalog in the version released on September 8.
Neither check rules out exploitation. That April flaw, an authentication bypass that needed no account at all, is in the same catalog with known use in ransomware campaigns.
Two other cPanel flaws disclosed since the end of July also start from an ordinary hosting account. A July 30 advisory covered a database flaw that could let an account with access to the database feature run database commands with full administrative privileges. cPanel described an August 27 flaw in domain parking that ended the same way as this one: code execution as root.
Repositories that present themselves as working exploits for those two flaws were online when The Hacker News checked on September 9.
cPanel credits Ali Mustafa (rz1027) and abed1526 with reporting this one. The CVE record for the August flaw credits the same name, Ali Mustafa.
Neither cPanel's advisories nor that record ties the two flaws to the same code. The records classify them differently: eval injection for the August flaw and SQL injection for this one, according to cPanel's own title.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/new-cpanel-flaw-lets-hosting-account.html